Who we are and scope of this policy
The data controller for personal data described in this policy is Regulation4U Ltd, a company registered in England and Wales under company number 17340209, with its registered office at 124 City Road, London, EC1V 2NX ("Regulation4U", "we", "us"). We can be contacted at support@regulation4u.com.
This policy explains how we handle personal data when you visit this website, purchase our digital products (the "Materials"), subscribe to our emails, or contact us. It applies alongside our Terms of Service. We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018, and — for visitors in the European Economic Area — the EU GDPR.
One important exception: when you pay, your payment is taken by Paddle, our merchant of record. Paddle acts as an independent data controller for the personal data it needs to process payments, calculate taxes, prevent fraud, and issue invoices (including your payment card details, which we never receive or store). Paddle's handling of that data is governed by Paddle's privacy policy.
The data we collect
- Identity and contact data — your name, email address, and organisation name (where you provide it), collected when you purchase, subscribe to our emails, or contact us.
- Transaction data — the tier purchased, price, currency, date, country (for tax), and order reference, shared with us by Paddle when you buy. We do not receive your card number or full payment details.
- Technical and usage data — IP address, device and browser type, operating system, approximate location (country/city level), pages visited, referral source, and interactions with the site, collected via cookies and the analytics services described in Section 5.
- Delivery and download data — your personal download tokens, link usage counts, download timestamps and related technical details, and purchaser identifiers (such as your email address and order reference) embedded into delivered files as an anti-piracy stamp.
- Marketing preferences — whether you have subscribed to or unsubscribed from our emails, and engagement data such as whether emails were opened or links clicked.
- Correspondence — the content of emails and messages you send us, including support and licensing enquiries.
We do not intentionally collect any special category data (such as health or political data), and ask that you do not send us any.
How and why we use your data (lawful bases)
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Delivering your purchase — providing download links and receipts (sent via Paddle) and providing customer support | Identity, contact, transaction, correspondence | Performance of a contract |
| Keeping records of transactions, licences, and refund/cooling-off status | Identity, transaction | Legal obligation; legitimate interests (record-keeping, defending claims) |
| Sending product updates, newsletters, and marketing (see Section 4) | Identity, contact, marketing preferences | Consent; or legitimate interests via the "soft opt-in" for existing customers |
| Understanding how the site is used and improving it (analytics) | Technical and usage data | Consent (for non-essential cookies); legitimate interests (aggregate, non-intrusive measurement) |
| Delivering your files securely, stamping them with purchaser identifiers, and monitoring download-link usage to detect and deter unauthorised distribution | Identity, transaction, delivery and download data | Performance of a contract; legitimate interests (protecting our intellectual property and enforcing licence terms) |
| Securing the website and preventing fraud and abuse | Technical data, transaction | Legitimate interests; legal obligation |
| Enforcing our Terms of Service, including licence limits | Identity, transaction, correspondence | Legitimate interests (protecting our rights and intellectual property) |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms; you may object at any time (Section 10). We do not use your personal data for automated decision-making that produces legal or similarly significant effects.
Marketing and newsletter emails
We send two kinds of email beyond transactional messages: product updates (new tools, revisions to Materials you own, regulatory-content updates) and a newsletter with practitioner content and offers.
- If you subscribe to the newsletter, we send it on the basis of your consent.
- If you purchase from us, we may send you updates and marketing about our own similar products under the "soft opt-in" in the Privacy and Electronic Communications Regulations 2003, having given you the chance to opt out at the point of purchase.
- Every email we send includes an unsubscribe link. You can also opt out at any time by emailing support@regulation4u.com. Opting out of marketing does not affect transactional emails needed to deliver your purchase.
International transfers
Some of our providers (including Google and, in some cases, Cloudflare's and Paddle's group companies or sub-processors) store or process data in the United States or other countries outside the UK. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place: UK adequacy regulations (including, for EU transfers, adequacy for the EEA and, for US transfers, the UK Extension to the EU–US Data Privacy Framework where the recipient is certified), or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, with supplementary measures where needed. You may contact us for more information about the safeguards applied to a specific transfer.
How long we keep your data
- Transaction and licensing records — 6 years from the end of the relevant financial year, to meet tax and legal obligations and to evidence your licence and cooling-off waiver.
- Marketing data — until you unsubscribe or ask us to delete it; suppression records (your email on a "do not contact" list) are kept so we can honour your opt-out.
- Analytics data — retained per the tool's configuration; aggregate statistics that no longer identify anyone may be kept indefinitely.
- Correspondence — as long as needed to handle the enquiry and for a reasonable period afterwards, then deleted.
When data is no longer needed, we delete or irreversibly anonymise it.
Security
We apply appropriate technical and organisational measures to protect personal data, including encryption of data in transit (HTTPS/TLS), access on a need-to-know basis, reputable providers with their own certified security programmes, and separation of payment data (held by Paddle, never by us). No transmission over the internet is entirely secure, but if we become aware of a personal data breach likely to result in a risk to your rights, we will notify the ICO and, where required, you, in accordance with UK GDPR.
Your rights
Under UK GDPR you have the right, in the circumstances the law provides, to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten");
- restrict our processing of your data;
- object to processing based on legitimate interests, and to direct marketing at any time (which we will always honour);
- data portability — receive data you provided to us in a structured, machine-readable format;
- withdraw consent at any time where processing is based on consent (without affecting prior processing).
To exercise any right, email support@regulation4u.com. We may need to verify your identity. We respond within one month (extendable by two months for complex requests, in which case we will tell you). Exercising your rights is free of charge except where requests are manifestly unfounded or excessive. Note that for payment data held by Paddle as an independent controller, you may also need to contact Paddle directly.
Children
This website and the Materials are professional resources intended for adults and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time, for example when we adopt a new analytics platform or email provider. The "last updated" date at the top shows the current version. Material changes will be highlighted on this page and, where appropriate, notified to subscribers by email.
Contact and complaints
Privacy questions, rights requests, and complaints: support@regulation4u.com, or write to Regulation4U Ltd, 124 City Road, London, EC1V 2NX.
You also have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk) or, if you are in the EEA, with your local supervisory authority.